NSA Document From 1996 Warns Of 'Insider-Gone-Bad'

Tweet

Authored by Kelsey D. Atherton. Mon, January 6, 2014 - 02:00pm
Source: http://feeds.popsci.com/c/34567/f/632419/s/35931add/sc/4/l/0L0Spopsci0N0Carticle...

NSA Powerpoint Slide

Even the slides get redacted.

NSA

A story quietly titled "Out of Control," published in a special 1996 issue of the National Security Agency's professional journal Cryptologic Quarterly, warns that one of the best ways into a computer system doesn't involve any hacking at all. The article foresees exactly the kind of threat Edward Snowden would pose to the agency in 2013.
The report opens:

In their quest to benefit from the great advantages of networked computer systems, the U.S., military and intelligence communities have put almost all of their classified information "eggs" into one very precarious basket: computer system administrators. A relatively small number of system administrators are able to read, copy, move, alter, and destroy almost every piece of classified information handled by a given agency or organization. An insider-gone-bad with enough hacking skills to gain root privileges might acquire similar capabilities.

Snowden apparently sought out just such a job as a contractor with the NSA because, in his own words, "My position with Booz Allen Hamilton granted me access to lists of machines all over the world the NSA hacked."
Thanks to the way electronic communication works, system administrators have access to a whole range of information stored on the networks they oversee. "Out of Control" also provides an almost quaint look at early 1990s use of systems like email and servers. The report is written for an audience that understood how to keep paper documents safe in the Cold War but needs help understanding the risks that come with new technology.

Intelligence personnel can no longer lock the draft versions of their Top Secret SCI reports in their safes at night and go home feeling reasonably secure. Instead, those reports and almost everything else they have done is out of their control, stored electronically on some server in some other room or even in another building.

Curiously, the policy recommendations made at the end of the report might all be valid security techniques, but they radically reduce the usefulness of computers for the people using them. One recommendation is for personal passwords that system admins cannot access, with the acknowledged risk of reports permanently lost when the user forgets their own password. Beyond encryption, the report recommends that hard drives used by analysts be "encrypted and stored in a three-combo safe," which would certainly make logging into work every morning a pleasant and totally enjoyable ordeal.
Another recommendation is that users be physically separated from the local network or the internet while working, only plugging the cables into the computer when needed to quickly send out messages and then staying offline the rest of the time. And, as with most any set of recommendations, there is a call for an increased budget. As the unknown author of "Out of Control" writes, budget cuts lead to low morale, and low morale makes it likelier a system administrator could be bribed by another country.
Finally, "Out of Control" hits at the main problem with private, compartmented, or secret information held somewhere outside the individual's control:

Yes, it is less expensive and far more convenient to store everything on servers, but just because it can be done does not mean that it should be done. If individual computer users are going to be held accountable for the classified information that each personally handles, then they must have more control over how and where their information is stored and who has access to it.

Two different versions of this report are available online: one from the NSA, and another from George Washington University's National Security Archive. Cryptome has a side-by-side comparison, so the differences in redactions are easy to see.
[h/t @DaveedGR]